Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
Our summary
GitLab has shipped an October 21 security release patching CVE-2026-110264, a maximum-severity (CVSS 10.0) flaw that could let an unauthenticated attacker execute arbitrary code on self-managed instances. The bug stems from an integer overflow in Onigmo, the bundled regular-expression engine, and impacts every release since version 7.0 from 2014, far beyond GitLab's usual three-release support window. Fixed builds were issued for 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, meaning even admins who applied the October 12 patch for CVE-2026-97229 remain exposed and must update again. GitLab.com and GitLab Dedicated are already protected, and the vendor has found no evidence of active exploitation so far, though it hasn't disclosed the exact attack prerequisites or offered a workaround besides patching. This marks the fourth RCE bug found in GitLab's regex compiler within a month by the same researcher, alongside ten other fixed issues including an account-takeover flaw (CVE-2026-15723) and an OAuth/OIDC cache-poisoning bug (CVE-2026-112212).
The Hacker News publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.